Description
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | Magento Commerce | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-5538 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation. |
 Github GHSA |
GHSA-w942-fw92-mqm2 | Magento Information Disclosure vulnerability |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: adobe
Published:
Updated: 2024-09-16T16:18:09.078Z
Reserved: 2021-03-16T00:00:00.000Z
Link: CVE-2021-28566
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-09-08T17:15:09.117
Modified: 2024-11-21T05:59:51.917
Link: CVE-2021-28566
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses